Data processing agreement

This DPA governs the processing of personal data that the Processor carries out on behalf of the Customer to provide FeatureLoop, in accordance with the applicable data protection law, including the General Data Protection Regulation (GDPR) where it applies.

• Nature and purpose: hosting and displaying the Customer's public ideas page; recording ideas and votes; verifying emails; sending transactional emails on behalf of the Customer's product; preventing abuse; and letting the Customer manage and export its data.
• Data subjects: end users and visitors of the Customer's public page.
• Categories of data: email and, if provided, name; content of ideas and votes; a random visitor identifier; an IP hash for anonymous votes; and technical data (IP, browser) in logs.
• Special categories: the service is not designed to process them and the Customer agrees not to request them from its users.
• Duration: the period during which the Customer uses the service, plus the deletion periods in "Return and deletion".

• Having a legal basis for the processing and giving lawful instructions.
• Informing its end users, including the use of their browser's local storage for the visitor identifier and session.
• Configuring the service (moderation, anonymous votes, domains) in line with its obligations.

• Processing the data only on the Customer's documented instructions (these terms, this DPA and the panel settings), unless the law requires otherwise, and telling the Customer if it believes an instruction infringes the law.
• Not using the data for its own purposes or selling it.
• Ensuring that the people authorized to process it are bound by confidentiality.
• Applying the security measures described below.
• Helping the Customer respond to data subject requests. The panel lets the Customer export and delete data; for anything else, the Processor will provide reasonable assistance.
• Notifying the Customer of any personal data breach without undue delay and, where possible, within 48 hours of becoming aware of it, with the information available.
• Assisting the Customer, to a reasonable extent, with impact assessments and consultations with the supervisory authority.

The Customer authorizes the Processor to use the following subprocessors:

• Cloudflare, Inc.: network, proxy and DNS in front of our servers, anti-abuse protection (Turnstile) and file storage (R2).
• Hetzner Online GmbH: servers (site, panel and API) and database, in the United States.
• Amazon Web Services, Inc. (Amazon SES): sending emails.

The Processor will give at least 30 days' notice of any new subprocessor, on this page and by email. The Customer may object on reasonable grounds; if no agreement is reached, it may stop using the service. The Processor imposes equivalent data protection obligations on its subprocessors and remains responsible for their compliance.

The data is hosted in the United States. When it is processed outside the Customer's country, the Processor relies on appropriate mechanisms, such as adequacy decisions or standard contractual clauses.

• Encryption of all traffic (HTTPS).
• Isolation of each customer's data in every query.
• Session tokens and sign-in links stored only as hashes; single-use links that expire after 15 minutes.
• IP of anonymous votes stored only as a hash with a rotating salt and deleted after 90 days.
• Anti-abuse protection (Turnstile) and rate limits.
• Restricted access to production systems and an audit log of panel actions.
• Scheduled deletion of data that is no longer needed.

The Customer can export each product's data as JSON at any time before deleting it. A deleted product stops being accessible immediately and its data is permanently deleted after 30 days. When the service ends, the Processor deletes the data unless the law requires it to be kept.

The Processor will make available to the Customer the information needed to demonstrate compliance with this DPA, preferably through documentation or questionnaires. The Customer may request an audit at most once a year, with 30 days' notice, at its own cost and without compromising the confidentiality of other customers.

The limitation of liability in the Terms of service applies, except where the law does not allow it. On personal data matters, this DPA prevails over the Terms in case of conflict.

Logical Design · [email protected].